PT-2026-31975 · Openclaw · Openclaw

Peng Zhou · Published 2026-03-29 · Updated 2026-04-10 · CVE-2026-35664

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.25

Description OpenClaw contains an authentication bypass issue in the raw card send surface. This allows unpaired recipients to create legacy callback payloads, bypassing DM pairing restrictions and reaching callback handling without authorization. The issue was resolved by rejecting legacy raw-card command payloads, ensuring callbacks remain on the normal paired path.

Recommendations Update to version 2026.3.25 or later.

Fix

Authentication Bypass Using an Alternate Path or Channel

Incorrect Authorization

Weakness Enumeration

CWE-288

CWE-863

Related Identifiers

CVE-2026-35664

GHSA-77W2-CRQV-CMV3

Affected Products

Openclaw

References · 7

• https://github.com/openclaw/openclaw/security/advisories/GHSA-77w2-crqv-cmv3 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/81c45976db532324b5a0918a70decc19520dc354 · Patch
• https://osv.dev/vulnerability/GHSA-77w2-crqv-cmv3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35664 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-dm-pairing-bypass-via-legacy-card-callbacks · Note
• https://twitter.com/CVEnew/status/2042710247186330065 · Twitter Post